ClawHub
Back to skill

Security audit

TikTok Ad Library API - Search Ads, Top Ads, Ad Detail

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward wrapper for Scavio's TikTok ad research API and its network/API-key use is disclosed and purpose-aligned.

Install this only if you are comfortable using Scavio as a third-party service for TikTok ad research. Keep SCAVIO_API_KEY out of source control, expect each API call to consume credits, and review the search terms or ad IDs before sending them to the service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search ads for a brand in the last 180 days
search = requests.post(f"{BASE}/api/v1/tiktok/ads/search", headers=HEADERS,
    json={"keyword": "nike", "country": "US", "period": 180, "limit": 20}).json()
for ad in search["data"]["ads"]:
    print(ad["ad_id"], ad["ctr"], ad["title"])

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
print(ad["ad_id"], ad["ctr"], ad["title"])

# 2. Top-performing ads in an industry
top = requests.post(f"{BASE}/api/v1/tiktok/ads/top", headers=HEADERS,
    json={"industry": "label_22108000000", "country": "US"}).json()

# 3. One ad in full, including a playable video URL, by an id from search

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
# 3. One ad in full, including a playable video URL, by an id from search
ad_id = search["data"]["ads"][0]["ad_id"]
detail = requests.post(f"{BASE}/api/v1/tiktok/ads/detail", headers=HEADERS,
    json={"ad_id": ad_id}).json()
d = detail["data"]
print(d["brand"], d["objective"], d["countries"], d["video"]["url"])

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

curl:

bash
curl -s https://api.scavio.dev/api/v1/tiktok/ads/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"nike","country":"US","period":180}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

curl:

bash
curl -s https://api.scavio.dev/api/v1/tiktok/ads/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"nike","country":"US","period":180}'